Fix bounded mailboxes, worker startup race, stale admin signal (#78, #79, #81)

[intendednull]

Summary

• Unbounded actor mailboxes enable OOM DoS across all actors #78: Replace unbounded actor mailbox channels with bounded (capacity 10,000) to prevent OOM DoS from message flooding. Adds spawn_with_capacity() API, diagnostic tracing::warn! for dropped messages, and shutdown deadlock protection.
• Worker startup race: NetworkActor drains gossip before StateActor is ready #79: Add tokio::sync::watch ready signal between StateActor and NetworkActor so gossip drain tasks wait for StateActor initialization before processing events. Backward compatible — omitting the signal preserves immediate drain behavior.
• Web UI admin check uses stale signal — race window for unauthorized actions #81: Replace get_untracked() with reactive get() for peer_id in member_list.rs reactive closures (lines 46, 124, 178, 227) for consistent reactive patterns. Line 247 correctly remains get_untracked() (event handler context).

Closes #78
Closes #79
Closes #81

Test plan

• mailbox_drops_messages_when_capacity_exceeded — verifies bounded channel rejects sends when full (channel-level + actor-level with spawn_with_capacity)
• shutdown_succeeds_with_full_mailbox — verifies shutdown doesn't deadlock when a mailbox is full
• pre_buffered_events_wait_for_state_ready_signal — 3 pre-buffered gossip events all arrive after ready signal fires
• network_actor_drains_immediately_without_ready_signal — backward compat: drain starts immediately when no ready signal is provided
• admin_buttons_hide_when_admin_status_revoked — admin buttons reactively hide when admin_ids signal changes
• admin_buttons_respond_to_peer_id_change — admin buttons reactively hide when peer_id signal changes (validates get() vs get_untracked())
• All 90 actor tests pass (2 new)
• All 10 worker tests pass (2 new)
• Full workspace tests pass
• Clippy: zero warnings
• WASM: compiles clean

https://claude.ai/code/session_0138qk6y8FcdTUbrVFaH7FXH